vitali87/code-graph-rag v0.0.845

on GitHub

🔒 Security

This release closes an EXECUTE_SHELL allowlist bypass: several allowlisted commands are generic "run anything" primitives, so an attacker-controlled repository could reach unconfined code execution through a command the allowlist treated as benign.

GHSA-wvxg-744g-6pcg - allowlisted launchers reach unconfined RCE (High, CVSS 7.3, CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, CWE-78 / CWE-863). xargs is allowlisted, but nothing stopped it launching an interpreter that is not (python3, perl, ruby, node, ...); the single blacklist rule meant to catch this only fired when a Python one-liner imported os by name, so subprocess, pty or ctypes slipped past. Execution was neither sandboxed to the project root nor limited to the allowlisted set, gated only by the approval step - one click in default mode, nothing under --yolo. The same review found six further spellings of the same class, all fixed here: sed writing outside the project root via -e 'w FILE', -i and -l flag clusters, sed -f running an unvetted script file, git --exec-path resolving a planted git-<name> binary, and git --git-dir / -C pointing at a repository whose alias.* config runs an arbitrary shell command. The guards now live on the launcher recursion, so nesting one allowlisted launcher inside another cannot weaken the decision. Credit: @SyedAnas01.

Affected: <= 0.0.844 · Patched: 0.0.845. Upgrade to 0.0.845 if you run cgr against repositories you do not fully control.

Highlights

• Security: Fixes an EXECUTE_SHELL allowlist bypass where allowlisted launchers (xargs, sed, git) could run unvetted programs or write outside the project root - advisory GHSA-wvxg-744g-6pcg. Upgrade is strongly recommended for anyone running cgr (CLI, agent, or MCP) against untrusted repositories.
• Test Reliability: Guard grammar-dependent tests on the production loader to prevent failures.
• Index Consistency: Ensure incremental deletes match clean index states.
• Patch Reporting: Distinguish between unverifiable and verified patches in reports.
• Windows Teardown: Clear the read-only bit when removing a temp repo for successful Windows teardown.
• TypeScript Grading: Grade TypeScript inheritance against the tsc oracle for improved accuracy.
• Exclude Set Handling: Record the exclusion set to ensure --exclude flags are correctly applied across runs.
• MCP Indexing: Honour .cgrignore and .gitignore in MCP index and update processes, matching the CLI.

What's Changed

• fix: guard grammar-dependent tests on the production loader, not on importability (#1591) by @vitali87 in #1593
• test: pin that an incremental delete matches a clean index by @vitali87 in #1594
• fix: report an unverifiable patch distinctly from a verified one by @vitali87 in #1595
• fix: clear the read-only bit when removing a temp repo so Windows teardown succeeds (#1586) by @vitali87 in #1597
• feat: grade TypeScript inheritance against the tsc oracle by @vitali87 in #1519
• fix: re-parse a directory's modules when its package-ness flips and prune the container node the flip left behind by @vitali87 in #1572
• fix: preserve rejected highlights in release news by @vitali87 in #1600
• docs: explain how indexing treats a git submodule by @vitali87 in #1596
• chore: exclude constants from coverage, matching the sonar config by @vitali87 in #1611
• fix: parse release highlights whose colon sits inside the bold theme by @vitali87 in #1614
• fix: report highlight parse failures instead of exiting 0 silently by @vitali87 in #1618
• fix: tolerate a path that vanishes mid-teardown (#1586 follow-up) by @vitali87 in #1598
• chore(deps): bump transformers from 5.5.0 to 5.10.1 in the uv group across 1 directory by @dependabot[bot] in #1607
• docs: backfill the v0.0.820 feature news the parse outage skipped by @vitali87 in #1623
• fix: record the exclusion set so a changed --exclude re-runs instead of skipping by @vitali87 in #1621
• fix: MCP index and update honour .cgrignore and .gitignore like the CLI (#1616) by @vitali87 in #1624
• fix: reset skipped_because_in_sync per run so a reused updater does not report a stale skip (#1620) by @vitali87 in #1626
• fix: accept a missing space after the colon in both news extractors by @vitali87 in #1627
• feat: verify a PR is actually gated before merging (#1582) by @vitali87 in #1625
• fix(fingerprint): treat capture selection as parser identity by @vitali87 in #1633
• fix: skip vendored minified bundles and make the ~ ignore entry live (#1636) by @vitali87 in #1638
• fix: commit the hash cache after the graph flush so a crash cannot hide a deletion by @vitali87 in #1635
• fix: let a run finish when the mis-stamped cache cannot be removed either by @vitali87 in #1644

Full Changelog: v0.0.820...v0.0.845